$ /usr/local/ruby-2.7.0/bin/ruby -v
ruby 2.7.0p0 (2019-12-25 revision 647ee6f091) [x86_64-linux]

$ LD_LIBRARY_PATH=/usr/local/openssl-1.1.1/lib /usr/local/openssl-1.1.1/bin/openssl version
OpenSSL 1.1.1w  11 Sep 2023

$ psql -h 127.0.0.1 -U judge0 -d judge0 -tAc "select version()"
PostgreSQL 14.24 (Ubuntu 14.24-0ubuntu0.22.04.1) on x86_64-pc-linux-gnu, compiled by gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0, 64-bit

$ redis-server --version
Redis server v=6.0.16 sha=00000000:0 malloc=jemalloc-5.2.1 bits=64 build=b4dcd1f8d6a59d4f

$ isolate --version
The process isolator 2.0
(c) 2012--2024 Martin Mares and Bernard Blackham
Built on 2026-10-27 from Git commit v2.0

apt-get update
apt-get install -y build-essential git curl wget pkg-config \
  zlib1g-dev libyaml-dev libffi-dev libreadline-dev libssl-dev libpq-dev \
  postgresql postgresql-contrib redis-server asciidoc-base libsystemd-dev

$ dpkg -l | grep -E "^ii  (postgresql-14|redis-server|libsystemd-dev|asciidoc-base)"
postgresql-14  14.24-0ubuntu0.22.04.1
postgresql-contrib  14+238
redis-server  5:6.0.16-1ubuntu1.2
asciidoc-base  10.1.2-1
libsystemd-dev:amd64  249.11-0ubuntu3.23

$ stat -fc %T /sys/fs/cgroup
cgroup2fs

$ id -u
0

export https_proxy=http://192.168.1.62:7897
export HTTPS_PROXY=http://192.168.1.62:7897

$ ruby -v
ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux-gnu]

cd /usr/local/src
curl -LO https://www.openssl.org/source/openssl-1.1.1w.tar.gz
tar xf openssl-1.1.1w.tar.gz && cd openssl-1.1.1w
./config --prefix=/usr/local/openssl-1.1.1 --openssldir=/usr/local/openssl-1.1.1 shared
make -j"$(nproc)"
make install_sw

$ /usr/local/openssl-1.1.1/bin/openssl version
/usr/local/openssl-1.1.1/bin/openssl: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory

$ LD_LIBRARY_PATH=/usr/local/openssl-1.1.1/lib /usr/local/openssl-1.1.1/bin/openssl version
OpenSSL 1.1.1w  11 Sep 2023

cd /usr/local/src
curl -LO https://cache.ruby-lang.org/pub/ruby/2.7/ruby-2.7.0.tar.gz
tar xf ruby-2.7.0.tar.gz && cd ruby-2.7.0
./configure --prefix=/usr/local/ruby-2.7.0 \
  --with-openssl-dir=/usr/local/openssl-1.1.1 \
  --disable-install-doc
make -j"$(nproc)"
make install

$ /usr/local/ruby-2.7.0/bin/ruby -v
ruby 2.7.0p0 (2019-12-25 revision 647ee6f091) [x86_64-linux]

$ /usr/local/ruby-2.7.0/bin/ruby -ropenssl -e "puts OpenSSL::OPENSSL_VERSION"
OpenSSL 1.1.1w  11 Sep 2023

$ /usr/local/ruby-2.7.0/bin/ruby -e "puts RbConfig::CONFIG['configure_args']"
 '--prefix=/usr/local/ruby-2.7.0' '--with-openssl-dir=/usr/local/openssl-1.1.1' '--disable-install-doc'

export PATH=/usr/local/ruby-2.7.0/bin:$PATH
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
gem install bundler -v 2.1.4

$ gem list bundler
bundler (2.1.4, default: 2.1.2)

su - postgres -c "psql -c \"CREATE ROLE judge0 LOGIN PASSWORD 'judge0_pg_pwd_2026' CREATEDB;\""
su - postgres -c "psql -c \"CREATE DATABASE judge0 OWNER judge0;\""

$ grep -vE "^#|^$" /etc/postgresql/14/main/pg_hba.conf
local   all             postgres                                peer
local   all             all                                     peer
host    all             all             127.0.0.1/32            scram-sha-256
host    all             all             ::1/128                 scram-sha-256

sed -i 's/^# requirepass foobared/requirepass judge0_redis_pwd_2026/' /etc/redis/redis.conf
systemctl restart redis-server

$ redis-cli ping
NOAUTH Authentication required.

$ redis-cli -a judge0_redis_pwd_2026 ping 2>/dev/null
PONG

git clone https://github.com/ioi/isolate.git /usr/local/src/isolate
cd /usr/local/src/isolate
make
make install

$ sudo isolate --cg --box-id=0 --init
Cannot open /run/isolate/cgroup: No such file or directory

cp /usr/local/src/isolate/systemd/isolate.slice \
   /usr/local/src/isolate/systemd/isolate.service /etc/systemd/system/
systemctl daemon-reload
systemctl enable --now isolate.service

$ systemctl is-active isolate.service
active

$ cat /etc/systemd/system/isolate.service
[Unit]
Description=A trivial daemon to keep Isolate's control group hierarchy

[Service]
Type=notify
ExecStart=/usr/local/sbin/isolate-cg-keeper
Slice=isolate.slice
Delegate=true

[Install]
WantedBy=multi-user.target

$ isolate --cg --box-id=0 --init
/var/local/lib/isolate/0

$ isolate --cg --box-id=0 --run -- /bin/echo hello_from_isolate
hello_from_isolate
OK (0.001 sec real, 0.010 sec wall)

$ isolate --cg --box-id=0 --cleanup

git clone --depth 1 https://github.com/judge0/judge0.git /opt/judge0
cd /opt/judge0
export PATH=/usr/local/ruby-2.7.0/bin:$PATH
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
bundle install

$ bundle check
The Gemfile's dependencies are satisfied

$ gem list puma resque pg
puma (4.3.5)
resque (2.0.0)
resque-scheduler (4.4.0)
pg (1.2.3)

REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_PASSWORD=judge0_redis_pwd_2026

POSTGRES_HOST=localhost
POSTGRES_PORT=5432
POSTGRES_DB=judge0
POSTGRES_USER=judge0
POSTGRES_PASSWORD=judge0_pg_pwd_2026

RAILS_ENV=production
RAILS_MAX_THREADS=6
RAILS_SERVER_PROCESSES=2

INTERVAL=0.1

cd /opt/judge0
set -a; source judge0.conf; set +a
export PATH=/usr/local/ruby-2.7.0/bin:$PATH
export RUBYOPT=-W:no-deprecated
export SECRET_KEY_BASE=$(head -c 96 /dev/urandom | base64 | tr -d '\n')

rails db:migrate
rails db:seed

$ export PGPASSWORD=judge0_pg_pwd_2026
$ psql -h 127.0.0.1 -U judge0 -d judge0 -tAc "select count(*) from schema_migrations"
24

$ psql -h 127.0.0.1 -U judge0 -d judge0 -tAc "select count(*) from languages"
89

mkdir -p /etc/judge0
echo "SECRET_KEY_BASE=$(head -c 96 /dev/urandom | base64 | tr -d '\n')" > /etc/judge0/secret.env
chmod 600 /etc/judge0/secret.env

# /etc/systemd/system/judge0-server.service
[Unit]
Description=Judge0 1.13.1 API server
After=network.target postgresql.service redis-server.service
Wants=postgresql.service redis-server.service

[Service]
Type=simple
User=root
WorkingDirectory=/opt/judge0
EnvironmentFile=/opt/judge0/judge0.conf
EnvironmentFile=/etc/judge0/secret.env
Environment=PATH=/usr/local/ruby-2.7.0/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Environment=JUDGE0_VERSION=1.13.1
Environment=PORT=8141
Environment=RAILS_LOG_TO_STDOUT=true
Environment=RUBYOPT=-W:no-deprecated
Environment=DISABLE_DATABASE_ENVIRONMENT_CHECK=1
ExecStart=/usr/local/ruby-2.7.0/bin/rails s -b 0.0.0.0 -p 8141
Restart=on-failure
RestartSec=5
LimitNOFILE=65535

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/judge0-worker.service
[Unit]
Description=Judge0 1.13.1 Resque worker
After=network.target judge0-server.service postgresql.service redis-server.service

[Service]
Type=simple
User=root
WorkingDirectory=/opt/judge0
EnvironmentFile=/opt/judge0/judge0.conf
EnvironmentFile=/etc/judge0/secret.env
Environment=PATH=/usr/local/ruby-2.7.0/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Environment=JUDGE0_VERSION=1.13.1
Environment=QUEUE=1.13.1
Environment=RAILS_LOG_TO_STDOUT=true
Environment=RUBYOPT=-W:no-deprecated
Environment=DISABLE_DATABASE_ENVIRONMENT_CHECK=1
ExecStart=/usr/local/ruby-2.7.0/bin/rake resque:work QUEUE=1.13.1
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable --now judge0-server.service judge0-worker.service

$ systemctl is-active judge0-server judge0-worker
active
active

[43444] Puma starting in cluster mode...
[43444] * Version 4.3.5 (ruby 2.7.0-p0), codename: Mysterious Traveller
[43444] * Min threads: 6, max threads: 6
[43444] * Environment: production
[43444] * Process workers: 2
[43444] * Listening on tcp://0.0.0.0:8141
[43444] - Worker 1 (pid: 43483) booted, phase: 0
[43444] - Worker 0 (pid: 43481) booted, phase: 0

#{submission.enable_per_process_and_thread_time_limit ? (cgroups.present? ? "--no-cg-timing" : "") : "--cg-timing"} \

$ curl -s -X POST "http://127.0.0.1:8141/submissions?wait=true" \
    -H "Content-Type: application/json" \
    -d '{"source_code":"print(\"hello judge0\")","language_id":71}' | python3 -m json.tool

{
    "stdout": "Usage: isolate [<options>] <command>\n\nOptions:\n    --as-uid=<uid>...",
    "time": "0.0",
    "memory": 0,
    "stderr": "isolate: unrecognized option '--cg-timing'\n",
    "token": "afcdfb5c-0a4d-47e2-acdd-2da08891ff18",
    "compile_output": null,
    "message": null,
    "status": {
        "id": 3,
        "description": "Accepted"
    }
}

cd /opt/judge0
cp app/jobs/isolate_job.rb app/jobs/isolate_job.rb.orig
python3 - <<'PY'
p = "/opt/judge0/app/jobs/isolate_job.rb"
s = open(p).read()
old = '''    #{submission.enable_per_process_and_thread_time_limit ? (cgroups.present? ? "--no-cg-timing" : "") : "--cg-timing"} \\\n'''
s = s.replace(old, "")
open(p, "w").write(s)
PY
grep -n "cg-timing\|cg-mem" app/jobs/isolate_job.rb

96:    #{submission.enable_per_process_and_thread_memory_limit ? "-m " : "--cg-mem="}#{Config::MAX_MEMORY_LIMIT} \
141:    #{submission.enable_per_process_and_thread_memory_limit ? "-m " : "--cg-mem="}#{Config::MAX_MEMORY_LIMIT} \
212:    #{submission.enable_per_process_and_thread_memory_limit ? "-m " : "--cg-mem="}#{submission.memory_limit} \
245:    submission.memory = (cgroups.present? ? metadata[:"cg-mem"] : metadata[:"max-rss"])

systemctl restart judge0-server judge0-worker

$ curl -s http://127.0.0.1:8141/about
{"version":"1.13.1","homepage":null,"source_code":null,"maintainer":null}

$ curl -s http://127.0.0.1:8141/languages | python3 -c "import sys,json;d=json.load(sys.stdin);print(len(d))"
47

$ curl -s -X POST "http://127.0.0.1:8141/submissions?base64_encoded=false&wait=true" \
    -H "Content-Type: application/json" \
    -d '{"source_code":"echo hello judge0; echo $((6*7))","language_id":43}' | python3 -m json.tool

{
    "stdout": "hello judge0\n42\n",
    "time": "0.003",
    "memory": 1004,
    "token": "b4b2bccf-374d-4a9c-a16c-417a48fdd929",
    "compile_output": null,
    "stderr": null,
    "message": null,
    "status": {
        "id": 3,
        "description": "Accepted"
    }
}

$ PGPASSWORD=judge0_pg_pwd_2026 psql -h 127.0.0.1 -U judge0 -d judge0 -tAc \
    "select token,status_id,time,memory from submissions order by id desc limit 1"
b4b2bccf-374d-4a9c-a16c-417a48fdd929|3|0.003|1004

sed -i 's/^GRUB_CMDLINE_LINUX="/GRUB_CMDLINE_LINUX="systemd.unified_cgroup_hierarchy=0 /' /etc/default/grub
update-grub
reboot

$ stat -fc %T /sys/fs/cgroup
tmpfs

$ ls -d /sys/fs/cgroup/memory
/sys/fs/cgroup/memory

cd /usr/local/src
git clone --branch v1.8.1 https://github.com/ioi/isolate.git isolate-1.8.1
cd isolate-1.8.1
make
make install

$ isolate --cg -b 6 --init
Failed to create control group /sys/fs/cgroup/memory/box-6/: No such file or directory

{"message":"No such file or directory @ rb_sysopen - /box/script.py","status":{"id":13}}

SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)

make: a2x: No such file or directory
fatal error: systemd/sd-daemon.h: No such file or directory

Cannot open /run/isolate/cgroup: No such file or directory

config/puma.rb:1:in `Integer': invalid value for Integer(): "" (ArgumentError)

$ systemctl is-active judge0-worker
inactive

{
    "stdout": null,
    "time": "0.002",
    "memory": 1004,
    "stderr": "run: line 1: /usr/local/python-3.8.1/bin/python3: No such file or directory\n",
    "message": "Exited with error status 127",
    "status": {"id": 11, "description": "Runtime Error (NZEC)"}
}

$ PGPASSWORD=judge0_pg_pwd_2026 psql -h 127.0.0.1 -U judge0 -d judge0 -c \
    "update languages set run_cmd='/usr/bin/python3 script.py' where id=71"

systemctl disable --now judge0-server judge0-worker
rm -f /etc/systemd/system/judge0-{server,worker}.service
systemctl daemon-reload

su - postgres -c "psql -c 'DROP DATABASE judge0;'"
su - postgres -c "psql -c 'DROP ROLE judge0;'"

isolate --cg --box-id=0 --cleanup 2>/dev/null || true
systemctl disable --now isolate.service
rm -rf /var/local/lib/isolate /run/isolate /opt/judge0 /etc/judge0

apt-get purge -y postgresql-14 postgresql-contrib redis-server
rm -rf /usr/local/ruby-2.7.0 /usr/local/openssl-1.1.1
rm -f /usr/local/bin/isolate /usr/local/sbin/isolate-cg-keeper